4168 matches found
GO-2024-3118 Windmill HTTP Request users.rs excessive authentication in github.com/windmill-labs/windmill
Windmill HTTP Request users.rs excessive authentication in github.com/windmill-labs/windmill...
Exploit for OS Command Injection in Progress Loadmaster
CVE-2024-1212 Command Injection Exploit for Kemp LoadMaster 🛡️...
CVE-2024-28100 Stored Cross-site Scripting leading to arbitrary actions taken on behalf of users in elabftw
eLabFTW is an open source electronic lab notebook for research labs. By uploading specially crafted files, a regular user can create a circumstance where a visitor's browser runs arbitrary JavaScript code in the context of the eLabFTW application. This can be triggered by the visitor viewing a li...
SafeTech Labs Launches World’s First Comprehensive Digital Legacy Solution for $52B Industry
Brussel, Belgium, 2nd September 2024, CyberNewsWire...
SaltStack Salt Master Server Root Key Disclosure
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SaltStack Salt Master Server Root Key Disclosure', 'Description' = %q This module exploits unauthenticated access to the prepauthinfo method in t...
SSL Labs API Client
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'activesupport/inflector' require 'json' require 'activesupport/coreext/hash' class MetasploitModule uri, 'agent' = useragent, 'method' = 'GET', 'varsget' = para...
Silicon Labs Series 2 HSE-SVH 安全漏洞
Silicon Labs Series 2 HSE-SVH is a wireless device from Silicon Labs, Inc. A security vulnerability exists in the Silicon Labs Series 2 HSE-SVH that originates from the TAMPERRSTCAUSE register may not be properly updated when a level 4 tamper event occurs. The following products are affected:...
CODAC Behavioral Healthcare, US Marshalls are latest ransomware targets
The Qilin ransomware group listed CODAC Behavioral Healthcare, a nonprofit health care treatment organization, as one of their latest victims. Qilin seems to have a preference for healthcare and support organizations. One of their most well-known victims was the pathology lab services provider...
A week in security (August 19 – August 25)
Last week on Malwarebytes Labs: Millennials’ sense of privacy uniquely tested in romantic relationships Hacked GPS tracker reveals location data of customers "We will hold them accountable": General Motors sued for selling customer driving data to third parties Why you need to know about ransomwa...
CVE-2024-3279
An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint. This vulnerability allows an anonymous attacker, without an account in the application, to import their own database file, leading to the deletion or spoofing of...
fence-agents 代码注入漏洞
fence-agents is an open source agent program from ClusterLabs that supports remote power management of clustered devices. A code injection vulnerability exists in fence-agents that stems from allowing remote code execution, which in turn leads to elevation of privilege...
CVE-2024-3279 Improper Access Control in mintplex-labs/anything-llm
An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint. This vulnerability allows an anonymous attacker, without an account in the application, to import their own database file, leading to the deletion or spoofing of...
CVE-2024-3279 Improper Access Control in mintplex-labs/anything-llm
An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint. This vulnerability allows an anonymous attacker, without an account in the application, to import their own database file, leading to the deletion or spoofing of...
CVE-2024-3279 Improper Access Control in mintplex-labs/anything-llm
An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint. This vulnerability allows an anonymous attacker, without an account in the application, to import their own database file, leading to the deletion or spoofing of...
CVE-2024-3279
The CVE concerns mintplex-labs/anything-llm, specifically the import endpoint. An improper access control flaw allegedly allows anonymous, unauthenticated users to import their own database file, potentially deleting or spoofing the existing anythingllm.db and enabling serving malicious data or c...
Windows Downgrade Attack Risks Exposing Patched Systems to Old Vulnerabilities
Microsoft said it is developing security updates to address two loopholes that it said could be abused to stage downgrade attacks against the Windows update architecture and replace current versions of the operating system files with older versions. The vulnerabilities are listed below -...
Atari Asteroids Hack Sparks Debate on Blockchain Gaming Transparency
Ataris Asteroids game was exposed as a fake "on-chain" experience. Stackr Labs reveals how the games leaderboard was…...
Vestaboard: Exploring Broken Access Controls and Privilege Escalation
The post Vestaboard: Exploring Broken Access Controls and Privilege Escalation appeared first on Rhino Security Labs...
PT-2024-28781 · Unknown · Com.Cascadialabs.Who
Name of the Vulnerable Software and Affected Versions: com.cascadialabs.who aka Who - Caller ID, Spam Block version 15.0 Description: The issue concerns the placement of sensitive information in the system log by the application. Recommendations: For version 15.0, consider restricting access to...
OneDrive Phishing Scam Tricks Users into Running Malicious PowerShell Script
Cybersecurity researchers are warning about a new phishing campaign that targets Microsoft OneDrive users with the aim of executing a malicious PowerShell script. "This campaign heavily relies on social engineering tactics to deceive users into executing a PowerShell script, thereby compromising...